Add "locked" flag to accounts, prevent blocked users from following, force-unfollow blocked users

6 files changed, 18 insertions, 2 deletions

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index d2d3bc4a4..8f1c8ac8a 100644
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -30,6 +30,10 @@ class ApiController < ApplicationController
     render json: { error: 'Remote SSL certificate could not be verified' }, status: 503
   end
 
+  rescue_from Mastodon::NotPermitted do
+    render json: { error: 'This action is not allowed' }, status: 403
+  end
+
   def doorkeeper_unauthorized_render_options(error: nil)
     { json: { error: (error.try(:description) || 'Not authorized') } }
   end
diff --git a/app/controllers/settings/profiles_controller.rb b/app/controllers/settings/profiles_controller.rb
index 9e8a7da8c..4be549958 100644
--- a/app/controllers/settings/profiles_controller.rb
+++ b/app/controllers/settings/profiles_controller.rb
@@ -1,12 +1,13 @@
 # frozen_string_literal: true
 
 class Settings::ProfilesController < ApplicationController
+  include ObfuscateFilename
+
   layout 'auth'
 
   before_action :authenticate_user!
   before_action :set_account
 
-  include ObfuscateFilename
   obfuscate_filename [:account, :avatar]
   obfuscate_filename [:account, :header]
 
@@ -23,7 +24,7 @@ class Settings::ProfilesController < ApplicationController
   private
 
   def account_params
-    params.require(:account).permit(:display_name, :note, :avatar, :header)
+    params.require(:account).permit(:display_name, :note, :avatar, :header, :locked)
   end
 
   def set_account
diff --git a/app/lib/exceptions.rb b/app/lib/exceptions.rb
new file mode 100644
index 000000000..359228c29
--- /dev/null
+++ b/app/lib/exceptions.rb
@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module Mastodon
+  class Error < StandardError; end
+  class NotPermitted < Error; end
+end
diff --git a/app/services/block_service.rb b/app/services/block_service.rb
index 6a032a5a1..66146a72a 100644
--- a/app/services/block_service.rb
+++ b/app/services/block_service.rb
@@ -5,7 +5,10 @@ class BlockService < BaseService
     return if account.id == target_account.id
 
     UnfollowService.new.call(account, target_account) if account.following?(target_account)
+    UnfollowService.new.call(target_account, account) if target_account.following?(account)
+
     account.block!(target_account)
+
     clear_timelines(account, target_account)
     clear_notifications(account, target_account)
   end
diff --git a/app/services/follow_service.rb b/app/services/follow_service.rb
index ed9b62455..02baa6553 100644
--- a/app/services/follow_service.rb
+++ b/app/services/follow_service.rb
@@ -8,6 +8,7 @@ class FollowService < BaseService
     target_account = follow_remote_account_service.call(uri)
 
     raise ActiveRecord::RecordNotFound if target_account.nil? || target_account.id == source_account.id || target_account.suspended?
+    raise Mastodon::NotPermitted       if target_account.blocking?(source_account)
 
     follow = source_account.follow!(target_account)
 
diff --git a/app/views/settings/profiles/show.html.haml b/app/views/settings/profiles/show.html.haml
index c2f1adb12..a8ea9bbc4 100644
--- a/app/views/settings/profiles/show.html.haml
+++ b/app/views/settings/profiles/show.html.haml
@@ -8,6 +8,7 @@
   = f.input :note, placeholder: t('simple_form.labels.defaults.note')
   = f.input :avatar, wrapper: :with_label
   = f.input :header, wrapper: :with_label
+  = f.input :locked, as: :boolean, wrapper: :with_label
 
   .actions
     = f.button :button, t('generic.save_changes'), type: :submit